we have one customer running the stateful inspection over a multilink interface. They claimed the stateful inspection caused them problems to surf the internet properly.
the configuration is as follows:
ip inspect name STATEFUL icmp
ip inspect name STATEFUL tcp
ip inspect name STATEFUL udp
ip address x.x.x.x 255.255.255.252
ip access-group xxx in
ip inspect STATEFUL out
no ip mroute-cache
ppp multilink group 1
service-policy output POL_AAA
shape peak 4000000 4000000 2000000
shape peak 2000000 2000000 2000000
shape peak 144000 144000 112000
the problem is, when surfing to some sites, the sites will display the "Error 502" and say "Remote server down or not responding"...and this appear on the site which has the link to the other address. Is that possible that the other address try to come in my router's interface using the same established session id (but now the source ip is different)? and the router just drop the packet? but in the access-list, we permit every address to come in anyway...
I hope i get my question right, 1 site which has a banner link from the other address can't be display, could it be possible that banner has difficulties to come in due to the stateful inspection?
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :